Introduction

The Guided Data Onboarding documentation assumes you are familiar with the Splunk software. If you are new to using Splunk Enterprise or to Splunk Cloud, see the Additional Resources topic in this manual.

To complete the tasks described in this manual, you must have the following:

About the Splunk Add-on for Amazon Kinesis Firehose

Splunk Add-on for Amazon Kinesis Firehose provides CIM-compatible knowledge for data collected through the HTTP event collector (HEC). After the Splunk platform indexes the events, you can analyze the data directly or use other Splunk apps, such as the Splunk App for AWS and Splunk Enterprise Security.

Prerequisites

SSL requirements

Amazon Kinesis Firehose requires that the HTTP Event Collector (HEC) endpoint be terminated with a valid CA-signed certificate that matches the DNS hostname that connects to the HEC endpoint. You must use a trusted CA-signed certificate in your configuration, self-signed certificates are not supported.

To send data directly into Splunk indexers in your own internal network or AWS VPC, install a CA-signed certificate on each indexer. To use an Elastic Load Balancer (ELB) to send data in distributed deployments, also install a CA-signed certificate on the load balancer.

Managed Splunk Cloud users are provided an ELB with a proper CA-signed certificate and a hostname for each stack.

Event formatting requirements

The Splunk Add-on for Amazon Kinesis Firehose supports data collection using raw and event HEC types. When you collect data using the raw endpoint, data is sent directly to the raw endpoint without any preprocessing.

When you collect data using an event endpoint, format your events into the JSON format expected by HEC before sending them from Amazon Kinesis Firehose to the Splunk platform. You can apply an AWS Lambda blueprint to preprocess your events into the JSON structure and set event-specific fields. This allows you greater control over how your events are handled by the Splunk platform. For example, you can create and apply a Lambda blueprint that sends data from the same Firehose stream to different indexes depending on event type. For information about using an AWS Lambda function to preprocess events into this format, see Use AWS Lambda with HTTP Event Collector on the Splunk Developer Portal.

Note: If you work with VPC Flow Log data, the aws:cloudwatchlogs:vpcflow contains a nested events JSON array that cannot be parsed by the HTTP Event Collector. In this case you can prepare this data for the Splunk platform using an AWS Lambda function that extracts the nested JSON events correctly into a newline-delimited set of events. For information about the required JSON structure, see Format events for HTTP Event Collector on the Splunk developer portal.

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »